Professional and organizational ethics

Security professionals hold unusual power. They can read other people's email, see salary files, reset any password and watch network traffic. They are trusted to use that access only for legitimate purposes, and to give honest advice even when it is unwelcome. Sub-domain 1.1 of the CISSP outline asks you to understand, adhere to and promote professional ethics, covering the ISC2 Code of Ethics and organizational codes of ethics. CISSP-101 introduced the ISC2 Code; this lesson applies it, and broader ethical reasoning, to the decisions security leaders face.

Why ethics is part of security

Ethics matters in security for practical as well as moral reasons. Controls depend on trustworthy people: separation of duties, monitoring and access reviews all assume that the people who run them act honestly. Organizations depend on honest risk reporting: a CISO who downplays risk to please executives deprives them of the information they need. And the profession depends on public trust: if security practitioners abused their access, organizations would be right to hesitate before granting it.

Ethics also fills gaps that law and policy leave. Laws lag behind technology, and policies cannot anticipate every situation. When a new tool can monitor employees' keystrokes, or an analyst discovers a colleague's personal information during an investigation, the question is not only 'is this legal?' but 'is this right?'.

The ISC2 Code of Ethics

All ISC2 members and certification holders agree to the ISC2 Code of Ethics. It has a preamble and four canons. The preamble states that the safety and welfare of society and the common good, duty to principals and to each other, require adherence and the appearance of adherence to the highest ethical standards of behaviour. The four canons, in order, are:

• Protect society, the common good, necessary public trust and confidence, and the infrastructure.
• Act honorably, honestly, justly, responsibly, and legally.
• Provide diligent and competent service to principals.
• Advance and protect the profession.

The order matters. When canons conflict, the earlier canon generally takes precedence. Protecting society comes before serving an employer; serving principals competently comes before advancing the profession. ISC2 quotes the canons in its own spelling, and complaints about members' conduct can be filed through its ethics process, which can lead to sanctions including revocation of certification. Only people directly harmed can file complaints under certain canons, but anyone can file under the first two.

On the exam, ethics questions often present a dilemma: an employer asks you to hide a breach, a client wants a report softened, a colleague is misusing access. The approach that best fits the canons usually involves honesty, following the law, escalating through proper channels and protecting the public, rather than either ignoring the problem or taking dramatic action on your own.

Organizational codes of ethics

Most organizations have a code of conduct or code of ethics that applies to all employees. Security leaders should know it, follow it and help shape it, because it sets expectations that security policies build on: acceptable use of systems, conflicts of interest, gifts, confidentiality, reporting concerns and consequences for violations. A good code is supported by training, leadership example, safe reporting channels and consistent enforcement. Codes that leaders ignore, or that punish people who report problems, destroy trust quickly.

Many professional bodies also have codes. The Internet Architecture Board's RFC 1087, Ethics and the Internet (1989), described as unethical any activity that seeks to gain unauthorized access, disrupts the intended use of the internet, wastes resources, destroys the integrity of computer-based information or compromises users' privacy. The Computer Ethics Institute's Ten Commandments of Computer Ethics (1992) include not using a computer to harm others, not snooping in others' files and not using others' resources without authorization. Engineering regulators, privacy professional associations and audit bodies such as ISACA have their own codes.

Whistleblowing and reporting concerns

Sometimes ethical duty requires reporting wrongdoing. Organizations should provide confidential or anonymous reporting channels, investigate reports promptly and protect people who report in good faith from retaliation. The usual path is internal first: raise the concern with your manager, then with compliance, legal, internal audit or the board's audit committee if needed. External reporting to regulators or law enforcement may be appropriate when internal channels fail, when the law requires it or when there is imminent risk of serious harm.

In Canada, whistleblower protection is patchy. The Criminal Code (section 425.1) makes it an offence for an employer to retaliate against an employee for providing information about an offence to law enforcement. The Public Servants Disclosure Protection Act protects federal public servants, and several provinces have similar public-sector laws. Securities regulators, including the Ontario Securities Commission, run whistleblower programs with anti-retaliation protections and awards, and PIPEDA protects employees who report contraventions to the Privacy Commissioner in good faith.

Common ethical dilemmas in security

Security work regularly raises questions that call for judgment.

• Monitoring: Monitoring employees can protect the organization, but must be lawful, proportionate and disclosed through policy. Reading personal messages out of curiosity is a breach of trust even if technically possible.
• Vulnerability disclosure: Researchers who find flaws should report them responsibly, usually privately to the vendor with time to fix before public disclosure (coordinated disclosure). Organizations should publish a vulnerability disclosure policy and not threaten good-faith researchers.
• Honest risk reporting: Softening findings to avoid embarrassment, or overstating them to win budget, both betray principals and, ultimately, society.
• Conflicts of interest: Recommending a product from a company in which you hold shares, or accepting lavish gifts from vendors, compromises independent advice.
• Breach concealment: Pressure to delay or avoid required notification puts individuals at risk and may break the law.
• Offensive tools and hacking back: Accessing an attacker's systems without authorization is generally illegal, even when the motive is defensive.

Ethical decision-making

When the right answer is not obvious, a structured approach helps. One common approach has five steps: gather the facts; identify the stakeholders and what each stands to gain or lose; identify the laws, policies and codes that apply; consider the options and their consequences, including what would happen if your decision were made public; then decide, act and document your reasoning. Several classic ethical theories can inform the options: consequentialism weighs outcomes, duty-based ethics asks which rules and obligations apply, and virtue ethics asks what a person of good character would do. In practice, the best decisions usually satisfy all three.

A simple test for many security dilemmas is to ask whether you would be comfortable explaining your action to the person affected, to your employer's board and to a journalist. If not, reconsider.

Ethics in emerging technologies

New technologies raise ethical questions faster than law can answer them. Artificial intelligence systems used for security, such as automated detection of insider threats, can flag people unfairly if they are trained on biased data or if their reasoning cannot be explained. Biometric systems raise questions about consent and the permanence of data that cannot be changed if stolen. Large-scale monitoring of networks and devices can reveal far more about people's lives than its purpose requires. Security leaders should ask, for each new capability, whether it is necessary, proportionate, transparent to those affected and subject to oversight.

Ethics also applies to how security professionals treat each other and the wider community. Sharing threat intelligence and lessons learned helps other organizations defend themselves, consistent with the canon on advancing the profession. Mentoring newcomers, giving credit for others' work, being honest about the limits of your own competence and declining work you are not qualified to do all reflect the third and fourth canons. Professional reputation in security is built slowly and lost quickly; a single breach of trust, such as misusing access or misrepresenting qualifications, can end a career and harm the standing of the profession as a whole.

Finally, ethical behaviour must be supported by systems, not left to individual heroism. Organizations reduce ethical pressure on staff by setting clear rules for monitoring and investigations, requiring approvals for sensitive actions, rotating duties, providing safe reporting channels and making it clear that honest bad news will be welcomed rather than punished.

When you face an ethical question on the CISSP exam, read the scenario carefully for clues about law, harm to the public and proper channels. Answers that involve deception, unauthorized access, ignoring legal duties or taking matters into your own hands are rarely correct. Answers that combine honesty, lawful action, protection of people and escalation through the right channels usually are. The same habits serve well in real practice, where reputations and careers depend on consistently trustworthy conduct over many years.

Ethical practice is ultimately what allows organizations to grant security professionals the broad access their work requires, and to trust the advice they give.